diff --git a/include/rekey/rnp_key_store.h b/include/rekey/rnp_key_store.h
index 942b06769e..ae6a4d002c 100644
--- a/include/rekey/rnp_key_store.h
+++ b/include/rekey/rnp_key_store.h
@@ -90,12 +90,12 @@ class KeyStore {
     /**
      * @brief Try to load key store from path.
      */
-    bool load(const pgp_key_provider_t *key_provider = nullptr);
+    bool load(const KeyProvider *key_provider = nullptr);
 
     /**
      * @brief Try to load key store from source.
      */
-    bool load(pgp_source_t &src, const pgp_key_provider_t *key_provider = nullptr);
+    bool load(pgp_source_t &src, const KeyProvider *key_provider = nullptr);
 
     /**
      * @brief Load all keys from the source, assuming openpgp format.
@@ -117,12 +117,12 @@ class KeyStore {
     /**
      * @brief Load keystore in kbx format.
      */
-    bool load_kbx(pgp_source_t &src, const pgp_key_provider_t *key_provider = nullptr);
+    bool load_kbx(pgp_source_t &src, const KeyProvider *key_provider = nullptr);
 
     /**
      * @brief Load keystore in g10 format.
      */
-    bool load_g10(pgp_source_t &src, const pgp_key_provider_t *key_provider = nullptr);
+    bool load_g10(pgp_source_t &src, const KeyProvider *key_provider = nullptr);
 
     /**
      * @brief Write keystore to the path.
@@ -168,7 +168,7 @@ class KeyStore {
      * @param prov key provider to request needed key.
      * @return pointer to the key or nullptr if signer's key was not found.
      */
-    pgp_key_t *get_signer(const pgp_signature_t &sig, pgp_key_provider_t *prov = nullptr);
+    pgp_key_t *get_signer(const pgp_signature_t &sig, const KeyProvider *prov = nullptr);
 
     /**
      * @brief Add key to the keystore, copying it.
diff --git a/src/lib/ffi-priv-types.h b/src/lib/ffi-priv-types.h
index 408bd622dd..97aef4cd0e 100644
--- a/src/lib/ffi-priv-types.h
+++ b/src/lib/ffi-priv-types.h
@@ -75,7 +75,7 @@ struct rnp_ffi_st {
     void *                  getkeycb_ctx;
     rnp_password_cb         getpasscb;
     void *                  getpasscb_ctx;
-    pgp_key_provider_t      key_provider;
+    rnp::KeyProvider        key_provider;
     pgp_password_provider_t pass_provider;
     rnp::SecurityContext    context;
 
diff --git a/src/lib/generate-key.cpp b/src/lib/generate-key.cpp
index 059c83e34f..8b6b047108 100644
--- a/src/lib/generate-key.cpp
+++ b/src/lib/generate-key.cpp
@@ -103,8 +103,8 @@ load_generated_g10_key(pgp_key_t *           dst,
     // G10 needs the pubkey for copying some attributes (key version, creation time, etc)
     key_ptrs.push_back(pubkey);
 
-    rnp::MemorySource  memsrc(memdst.memory(), memdst.writeb(), false);
-    pgp_key_provider_t prov(rnp_key_provider_key_ptr_list, &key_ptrs);
+    rnp::MemorySource memsrc(memdst.memory(), memdst.writeb(), false);
+    rnp::KeyProvider  prov(rnp_key_provider_key_ptr_list, &key_ptrs);
     if (!key_store.get()->load_g10(memsrc.src(), &prov)) {
         return false;
     }
diff --git a/src/lib/key-provider.cpp b/src/lib/key-provider.cpp
index 6ef89e3249..dbc49be282 100644
--- a/src/lib/key-provider.cpp
+++ b/src/lib/key-provider.cpp
@@ -33,8 +33,9 @@
 #include "utils.h"
 #include <rekey/rnp_key_store.h>
 
+namespace rnp {
 pgp_key_t *
-pgp_key_provider_t::request_key(const pgp_key_request_ctx_t &ctx) const
+KeyProvider::request_key(const pgp_key_request_ctx_t &ctx) const
 {
     pgp_key_t *key = nullptr;
     if (!callback) {
@@ -49,6 +50,7 @@ pgp_key_provider_t::request_key(const pgp_key_request_ctx_t &ctx) const
     }
     return key;
 }
+} // namespace rnp
 
 pgp_key_t *
 rnp_key_provider_key_ptr_list(const pgp_key_request_ctx_t *ctx, void *userdata)
@@ -65,11 +67,11 @@ rnp_key_provider_key_ptr_list(const pgp_key_request_ctx_t *ctx, void *userdata)
 pgp_key_t *
 rnp_key_provider_chained(const pgp_key_request_ctx_t *ctx, void *userdata)
 {
-    for (pgp_key_provider_t **pprovider = (pgp_key_provider_t **) userdata;
+    for (rnp::KeyProvider **pprovider = (rnp::KeyProvider **) userdata;
          pprovider && *pprovider;
          pprovider++) {
-        pgp_key_provider_t *provider = *pprovider;
-        pgp_key_t *         key = NULL;
+        auto       provider = *pprovider;
+        pgp_key_t *key = nullptr;
         if ((key = provider->callback(ctx, provider->userdata))) {
             return key;
         }
diff --git a/src/lib/key-provider.h b/src/lib/key-provider.h
index 44be4b8182..9ef96fb4b5 100644
--- a/src/lib/key-provider.h
+++ b/src/lib/key-provider.h
@@ -67,11 +67,13 @@ typedef struct pgp_key_request_ctx_t {
 
 typedef pgp_key_t *pgp_key_callback_t(const pgp_key_request_ctx_t *ctx, void *userdata);
 
-typedef struct pgp_key_provider_t {
+namespace rnp {
+class KeyProvider {
+  public:
     pgp_key_callback_t *callback;
     void *              userdata;
 
-    pgp_key_provider_t(pgp_key_callback_t *cb = nullptr, void *ud = nullptr)
+    KeyProvider(pgp_key_callback_t *cb = nullptr, void *ud = nullptr)
         : callback(cb), userdata(ud){};
 
     /** @brief request public or secret pgp key, according to information stored in ctx
@@ -80,7 +82,8 @@ typedef struct pgp_key_provider_t {
      *  @return a key pointer on success, or nullptr if key was not found otherwise
      **/
     pgp_key_t *request_key(const pgp_key_request_ctx_t &ctx) const;
-} pgp_key_provider_t;
+};
+} // namespace rnp
 
 /** key provider callback that searches a list of pgp_key_t pointers
  *
@@ -99,8 +102,8 @@ pgp_key_t *rnp_key_provider_store(const pgp_key_request_ctx_t *ctx, void *userda
 /** key provider that calls other key providers
  *
  *  @param ctx
- *  @param userdata must be an array pgp_key_provider_t pointers,
- *         ending with a NULL.
+ *  @param userdata must be an array rnp::KeyProvider pointers,
+ *         ending with a nullptr.
  */
 pgp_key_t *rnp_key_provider_chained(const pgp_key_request_ctx_t *ctx, void *userdata);
 
diff --git a/src/lib/pgp-key.cpp b/src/lib/pgp-key.cpp
index 7a959c1261..a3043fca02 100644
--- a/src/lib/pgp-key.cpp
+++ b/src/lib/pgp-key.cpp
@@ -397,10 +397,7 @@ pgp_subkey_set_expiration(pgp_key_t *                    sub,
 }
 
 pgp_key_t *
-find_suitable_key(pgp_op_t            op,
-                  pgp_key_t *         key,
-                  pgp_key_provider_t *key_provider,
-                  bool                no_primary)
+find_suitable_key(pgp_op_t op, pgp_key_t *key, rnp::KeyProvider *key_provider, bool no_primary)
 {
     if (!key || !key_provider) {
         return NULL;
diff --git a/src/lib/pgp-key.h b/src/lib/pgp-key.h
index 111938a39d..e080c586a3 100644
--- a/src/lib/pgp-key.h
+++ b/src/lib/pgp-key.h
@@ -642,10 +642,10 @@ bool pgp_subkey_set_expiration(pgp_key_t *                    sub,
  *  @returns key or last created subkey with desired usage flag
  *           set or NULL if not found
  */
-pgp_key_t *find_suitable_key(pgp_op_t            op,
-                             pgp_key_t *         key,
-                             pgp_key_provider_t *key_provider,
-                             bool                no_primary = false);
+pgp_key_t *find_suitable_key(pgp_op_t          op,
+                             pgp_key_t *       key,
+                             rnp::KeyProvider *key_provider,
+                             bool              no_primary = false);
 
 /*
  *  Picks up hash algorithm according to domain parameters set
diff --git a/src/lib/rnp.cpp b/src/lib/rnp.cpp
index ead39a61dd..c9d6949f25 100644
--- a/src/lib/rnp.cpp
+++ b/src/lib/rnp.cpp
@@ -1366,9 +1366,9 @@ FFI_GUARD
 static rnp_result_t
 load_keys_from_input(rnp_ffi_t ffi, rnp_input_t input, rnp::KeyStore *store)
 {
-    pgp_key_provider_t        chained(rnp_key_provider_store, store);
-    const pgp_key_provider_t *key_providers[] = {&chained, &ffi->key_provider, NULL};
-    const pgp_key_provider_t  key_provider(rnp_key_provider_chained, key_providers);
+    rnp::KeyProvider        chained(rnp_key_provider_store, store);
+    const rnp::KeyProvider *key_providers[] = {&chained, &ffi->key_provider, NULL};
+    const rnp::KeyProvider  key_provider(rnp_key_provider_chained, key_providers);
 
     if (!input->src_directory.empty()) {
         // load the keys
@@ -2723,10 +2723,9 @@ static pgp_write_handler_t
 pgp_write_handler(pgp_password_provider_t *pass_provider,
                   rnp_ctx_t *              rnpctx,
                   void *                   param,
-                  pgp_key_provider_t *     key_provider)
+                  rnp::KeyProvider *       key_provider)
 {
-    pgp_write_handler_t handler;
-    memset(&handler, 0, sizeof(handler));
+    pgp_write_handler_t handler{};
     handler.password_provider = pass_provider;
     handler.ctx = rnpctx;
     handler.param = param;
@@ -3276,7 +3275,7 @@ try {
     handler.password_provider = &op->ffi->pass_provider;
 
     rnp_decryption_kp_param_t kparam(op);
-    pgp_key_provider_t        kprov = {ffi_decrypt_key_provider, &kparam};
+    rnp::KeyProvider          kprov(ffi_decrypt_key_provider, &kparam);
 
     handler.key_provider = &kprov;
     handler.on_signatures = rnp_op_verify_on_signatures;
diff --git a/src/librekey/key_store_g10.cpp b/src/librekey/key_store_g10.cpp
index 7fa629cf30..310c810580 100644
--- a/src/librekey/key_store_g10.cpp
+++ b/src/librekey/key_store_g10.cpp
@@ -895,11 +895,11 @@ copy_secret_fields(pgp_key_pkt_t &dst, const pgp_key_pkt_t &src)
 
 namespace rnp {
 bool
-KeyStore::load_g10(pgp_source_t &src, const pgp_key_provider_t *key_provider)
+KeyStore::load_g10(pgp_source_t &src, const KeyProvider *key_provider)
 {
     try {
         /* read src to the memory */
-        rnp::MemorySource memsrc(src);
+        MemorySource memsrc(src);
         /* parse secret key: fills material and sec_protection only */
         pgp_key_pkt_t seckey;
         if (!g23_parse_seckey(seckey, (uint8_t *) memsrc.memory(), memsrc.size(), NULL)) {
diff --git a/src/librekey/key_store_kbx.cpp b/src/librekey/key_store_kbx.cpp
index 35ab04b07a..df6823b5dd 100644
--- a/src/librekey/key_store_kbx.cpp
+++ b/src/librekey/key_store_kbx.cpp
@@ -380,12 +380,12 @@ kbx_parse_blob(const uint8_t *image, size_t image_len)
 } // namespace
 
 bool
-KeyStore::load_kbx(pgp_source_t &src, const pgp_key_provider_t *key_provider)
+KeyStore::load_kbx(pgp_source_t &src, const KeyProvider *key_provider)
 {
     try {
-        rnp::MemorySource mem(src);
-        size_t            has_bytes = mem.size();
-        uint8_t *         buf = (uint8_t *) mem.memory();
+        MemorySource mem(src);
+        size_t       has_bytes = mem.size();
+        uint8_t *    buf = (uint8_t *) mem.memory();
 
         if (has_bytes < BLOB_FIRST_SIZE) {
             RNP_LOG("Too few bytes for valid KBX");
@@ -425,9 +425,9 @@ KeyStore::load_kbx(pgp_source_t &src, const pgp_key_provider_t *key_provider)
                     return false;
                 }
 
-                rnp::MemorySource blsrc(pgp_blob.image().data() + pgp_blob.keyblock_offset(),
-                                        pgp_blob.keyblock_length(),
-                                        false);
+                MemorySource blsrc(pgp_blob.image().data() + pgp_blob.keyblock_offset(),
+                                   pgp_blob.keyblock_length(),
+                                   false);
                 if (load_pgp(blsrc.src())) {
                     return false;
                 }
diff --git a/src/librekey/rnp_key_store.cpp b/src/librekey/rnp_key_store.cpp
index a361791a88..5de3d1d13a 100644
--- a/src/librekey/rnp_key_store.cpp
+++ b/src/librekey/rnp_key_store.cpp
@@ -60,7 +60,7 @@
 
 namespace rnp {
 bool
-KeyStore::load(const pgp_key_provider_t *key_provider)
+KeyStore::load(const KeyProvider *key_provider)
 {
     pgp_source_t src = {};
 
@@ -101,7 +101,7 @@ KeyStore::load(const pgp_key_provider_t *key_provider)
 }
 
 bool
-KeyStore::load(pgp_source_t &src, const pgp_key_provider_t *key_provider)
+KeyStore::load(pgp_source_t &src, const KeyProvider *key_provider)
 {
     switch (format) {
     case PGP_KEY_STORE_GPG:
@@ -622,7 +622,7 @@ KeyStore::search(const pgp_key_search_t &search, pgp_key_t *after)
 }
 
 pgp_key_t *
-KeyStore::get_signer(const pgp_signature_t &sig, pgp_key_provider_t *prov)
+KeyStore::get_signer(const pgp_signature_t &sig, const KeyProvider *prov)
 {
     pgp_key_request_ctx_t ctx(PGP_OP_VERIFY, false, PGP_KEY_SEARCH_UNKNOWN);
     /* if we have fingerprint let's check it */
diff --git a/src/librepgp/stream-parse.h b/src/librepgp/stream-parse.h
index 4f22b9a6ca..a3f04a41c9 100644
--- a/src/librepgp/stream-parse.h
+++ b/src/librepgp/stream-parse.h
@@ -60,9 +60,9 @@ typedef void pgp_decryption_done_func_t(bool validated, void *param);
 /* handler used to return needed information during pgp source processing */
 typedef struct pgp_parse_handler_t {
     pgp_password_provider_t *password_provider; /* if NULL then default will be used */
-    pgp_key_provider_t *     key_provider; /* must be set when key is required, i.e. during
-                                              signing/verification/public key encryption and
-                                              deryption */
+    rnp::KeyProvider *       key_provider; /* must be set when key is required, i.e. during
+                                                signing/verification/public key encryption and
+                                                deryption */
     pgp_destination_func_t *dest_provider; /* called when destination stream is required */
     pgp_source_func_t *     src_provider;  /* required to provider source during the detached
                                               signature verification */
diff --git a/src/librepgp/stream-write.h b/src/librepgp/stream-write.h
index 49431f9152..d4b12ce8f6 100644
--- a/src/librepgp/stream-write.h
+++ b/src/librepgp/stream-write.h
@@ -35,11 +35,11 @@
 #include "stream-ctx.h"
 
 typedef struct pgp_write_handler_t {
-    pgp_password_provider_t *password_provider;
-    pgp_key_provider_t *     key_provider;
-    rnp_ctx_t *              ctx;
+    pgp_password_provider_t *password_provider{};
+    rnp::KeyProvider *       key_provider{};
+    rnp_ctx_t *              ctx{};
 
-    void *param;
+    void *param{};
 } pgp_write_handler_t;
 
 /** @brief sign the input data, producing attached, detached or cleartext signature.
diff --git a/src/tests/key-grip.cpp b/src/tests/key-grip.cpp
index bab1c9dc69..79c97e7e1c 100644
--- a/src/tests/key-grip.cpp
+++ b/src/tests/key-grip.cpp
@@ -39,7 +39,7 @@ TEST_F(rnp_tests, key_grip)
 
     auto sec_store = new rnp::KeyStore(
       PGP_KEY_STORE_G10, "data/test_stream_key_load/g10/private-keys-v1.d", global_ctx);
-    pgp_key_provider_t key_provider(rnp_key_provider_store, pub_store);
+    rnp::KeyProvider key_provider(rnp_key_provider_store, pub_store);
     assert_true(sec_store->load(&key_provider));
 
     const pgp_key_t *key = NULL;
diff --git a/src/tests/key-store-search.cpp b/src/tests/key-store-search.cpp
index d75322b632..4acc69d2cc 100644
--- a/src/tests/key-store-search.cpp
+++ b/src/tests/key-store-search.cpp
@@ -170,7 +170,7 @@ TEST_F(rnp_tests, test_key_store_search_by_name)
     // load secring
     auto sec_store =
       new rnp::KeyStore(PGP_KEY_STORE_G10, "data/keyrings/3/private-keys-v1.d", global_ctx);
-    pgp_key_provider_t key_provider(rnp_key_provider_store, pub_store);
+    rnp::KeyProvider key_provider(rnp_key_provider_store, pub_store);
     assert_true(sec_store->load(&key_provider));
 
     /* Main key fingerprint and id:
diff --git a/src/tests/key-validate.cpp b/src/tests/key-validate.cpp
index 91bf43718f..a361cd6ac3 100644
--- a/src/tests/key-validate.cpp
+++ b/src/tests/key-validate.cpp
@@ -97,7 +97,7 @@ TEST_F(rnp_tests, test_key_validate)
 
     secring =
       new rnp::KeyStore(PGP_KEY_STORE_G10, "data/keyrings/3/private-keys-v1.d", global_ctx);
-    pgp_key_provider_t key_provider(rnp_key_provider_store, pubring);
+    rnp::KeyProvider key_provider(rnp_key_provider_store, pubring);
     assert_true(secring->load(&key_provider));
     assert_true(all_keys_valid(secring));
     delete pubring;
diff --git a/src/tests/load-g10.cpp b/src/tests/load-g10.cpp
index 31af17a0e9..8e3fed32a9 100644
--- a/src/tests/load-g10.cpp
+++ b/src/tests/load-g10.cpp
@@ -31,7 +31,7 @@
 
 TEST_F(rnp_tests, test_invalid_g10)
 {
-    pgp_key_provider_t key_provider(rnp_key_provider_store);
+    rnp::KeyProvider key_provider(rnp_key_provider_store);
     // load pubring
     auto pub_store =
       new rnp::KeyStore(PGP_KEY_STORE_KBX, "data/keyrings/3/pubring.kbx", global_ctx);
@@ -53,7 +53,7 @@ TEST_F(rnp_tests, test_invalid_g10)
  */
 TEST_F(rnp_tests, test_load_g10)
 {
-    pgp_key_provider_t key_provider(rnp_key_provider_store);
+    rnp::KeyProvider key_provider(rnp_key_provider_store);
 
     // load pubring
     auto pub_store =
diff --git a/src/tests/load-g23.cpp b/src/tests/load-g23.cpp
index 35b4efcdeb..f42e2b2313 100644
--- a/src/tests/load-g23.cpp
+++ b/src/tests/load-g23.cpp
@@ -34,7 +34,7 @@
  */
 TEST_F(rnp_tests, test_load_g23)
 {
-    pgp_key_provider_t key_provider(rnp_key_provider_store);
+    rnp::KeyProvider key_provider(rnp_key_provider_store);
 
     /* another store */
     auto pub_store = new rnp::KeyStore(